The hyperion-react-native-testapp npm package contains malicious code that executes a preinstall script during npm install. This script sends the installer's username, current directory, and hostname to a third-party webhook URL without user consent. This behavior constitutes unauthorized data exfiltration and is consistent with dependency confusion proof-of-concept techniques, though the exfiltration itself is real regardless of intent.